A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65ed462b819c09 could have been used by an attacker to achieve remote code execution. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HFacebook Hermes
APPFacebookall versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEMemory
Related vulnerabilities
CVE-2023-28081CRITICAL9.8PL ✓same product
Use-after-free w Facebook Hermes umożliwiający RCE przez payload JS
CVE-2023-23556CRITICAL9.8PL ✓same product
RCE w Facebook Hermes — błąd zapisu poza granicami przy konwersji BigInt
CVE-2023-23557CRITICAL9.8PL ✓same product
RCE w Facebook Hermes via type confusion przy kopiowaniu właściwości obiektów
CVE-2023-25933CRITICAL9.8PL ✓same product
Type confusion w TypedArray silnika Hermes umożliwia RCE przez JavaScript
CVE-2022-32234CRITICAL9.8PL ✓same product
Out-of-bounds write w Facebook Hermes przy obsłudze dużych tablic